Moving Your BCM Program Forward - It's Time to Perform a Recoverability Measurement!

Michael Harding, BCM Project Leader III , Automotive Resources International (ARI)
66
110
24
Michael Harding, BCM Project Leader III , Automotive Resources International (ARI)

Michael Harding, BCM Project Leader III , Automotive Resources International (ARI)

Introduction

I received a meeting invite from a newly appointed VP of Operations who requested that I meet with him to learn more about our Global Business Continuity Management (BCM) program. Since I had over 10-years of BCM experience at the time, I felt ready for the meeting. I was in charge of making sure we carried out planning activities (RA, BIA, BC Plans) on an annual basis.

As I started going through the metrics (number of plans and frequency of updates), I could tell that he wanted to say something but he let me finish my presentation and I awaited his feedback and thoughts. The VP asked, 'Can we recover?’ Yes, it was a very succinct, almost piercing question since I did not have a solid response. While I looked confident, my inside voice was trembling.

Being Prepared is not the same as being able to Recover​

My initial thought was to Google recoverability measurements to see what already existed that perhaps I could leverage within my program. I found some interesting articles but they were quite advanced and I had a feeling they would not work within our environment. It is very important to understand the culture of your company to ensure you implement a tool that will be generally accepted and will provide added value to your BCM program.

Understand your Program Elements

I must mention that I have incorporated what is commonly known as 'all hazards' planning, which is the notion that you do not plan for specific scenarios (Floods, fire, earthquake, water main leak, protests) but rather look at outcomes such as Loss of Building, Staff, Technology or Supplier. As BC practioners, we understand that it is not always the calamity that will take down your operations; it could be something as benign as the water line flooding all weekend onto your records management area.

Keep it simple

My goal was to keep it simple, at least during the initial round of introducing the measurement into our program, to get 'buy in' and to see how it would be received by the Plan Owners. After brainstorming for quite a while, I decided that our measurement would be focused on the ability to recover within the department's requested Recovery Time Objective RTO. I created the following mind map to help with each component by listing some questions—obviously, you can change these to make sense for your organization.

  It is very important to understand the culture of your company to ensure you implement a tool that will be generally accepted and will provide added value to your BCM program  

I decided to use ranges rather than asking workshop participants whether a resource availability would be 18 percent, 37 percent, 65 percent or 80 percent. The following scale would identify the likelihood the component would be available within the RTO.

Conducting the Recoverability Measurement

My recommendation is to start with the most critical processes. Explain that the reason for the workshops is to elevate and further strengthen your BCM program. It helps to solidify all of your efforts and helps get 'buy in' to attend the session. As mentioned, start by focusing on your most critical business processes. 

Ensure appropriate staff attends

Make sure you have the appropriate staff in the workshop. Our program identifies a Plan Owner who is ultimately responsible for their departments BCP. Make sure to inform everyone that the results will be used to help strengthen their department’s ability to recover since deficiencies will be brought to the attention of senior management.

Challenge the Team

I use the recoverability measurement workshop as a space for the team to speak about their capabilities. I have even seen RTOs changed during the workshop. Since I am familiar with their documentation, I am able to ask questions such as, “Well, if the building goes away or is otherwise inaccessible, how would you be able to continue the process if equipment x is not operational?’ Leveraging their documents and having a solid understanding of their business processes will enable you to dive deeper into each area as needed.

Read Also

Using

Using "The Box" for Disaster Recovery Planning

Eric J. Satterly, Vice Provost for Information Technology
Disaster Recovery: A Continuous Journey

Disaster Recovery: A Continuous Journey

Mathew Beall, VP of Infrastructure, First American Financial Corporation
Crisis and Incident Management for the 21st Century

Crisis and Incident Management for the 21st Century

Louis Grosskopf, General Manager, Business Continuity Software, Sungard Availability Services